build(deps): second dependency sweep + VSTest → Microsoft.Testing.Platform; Dependabot to security-only

.github/dependabot.yml

@@ -1,15 +1,28 @@
 version: 2
+
+# Security updates only.
+#
+# `open-pull-requests-limit: 0` turns off routine version-update PRs for an
+# ecosystem while leaving Dependabot *security* updates untouched — those are
+# controlled by the repository's "Dependabot security updates" setting and are
+# still raised against a published advisory. Dependency currency is instead
+# handled by periodic, test-verified sweeps (see CLAUDE.md → Outstanding work).
+#
+# To turn routine updates back on, restore the previous limits (nuget: 10,
+# github-actions: default) and set an interval.
 updates:
   - package-ecosystem: "nuget"
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "build"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "ci"

.github/workflows/_test.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
 
@@ -36,17 +36,20 @@ jobs:
         if: runner.os == 'Linux'
         run: dotnet format UniswapSharp.sln --verify-no-changes
 
+      # xunit.v3 4.x runs on Microsoft.Testing.Platform (see global.json), so the reporting
+      # flags are MTP's and go after `--`, not VSTest's --logger / --collect.
       - name: Test
         run: >
-          dotnet test -c Release --no-build
-          --logger "trx;LogFileName=test-results.trx"
+          dotnet test -c Release --no-build --
+          --report-trx --report-trx-filename test-results.trx
           --results-directory ${{ github.workspace }}/TestResults
-          --collect:"XPlat Code Coverage"
+          --coverage --coverage-output-format cobertura
+          --coverage-output coverage.cobertura.xml
 
       # --- Reporting (single OS leg to avoid duplicate comments) ---
       - name: Publish test results
         if: always() && runner.os == 'Linux'
-        uses: EnricoMi/publish-unit-test-result-action@82082dac68ad6a19d980f8ce817e108b9f496c2a # v2.17.1
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
         with:
           check_name: "Test Results"
           files: "${{ github.workspace }}/TestResults/**/*.trx"

.github/workflows/codeql.yml

@@ -22,17 +22,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           languages: csharp
           build-mode: manual
       - name: Build
         run: dotnet build -c Release
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           category: "/language:csharp"

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0   # MinVer needs full history/tags
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
 
@@ -50,7 +50,7 @@ jobs:
             --source https://api.nuget.org/v3/index.json --skip-duplicate
 
       - name: Attach artifacts to GitHub Release
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: ./artifacts/*
           # SemVer pre-release tags carry a hyphen (v1.0.0-rc.1); flag those so the GitHub

CHANGELOG.md

@@ -6,6 +6,19 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+### Changed
+- Dependency sweep, verified behind a green 1,695-test suite: `xunit.v3` 3.2.2 → 4.0.0,
+  `xunit.runner.visualstudio` 3.1.5 → 4.0.0, `Microsoft.NET.Test.Sdk` 18.7.0 → 18.9.0,
+  `AwesomeAssertions` 9.4.0 → 9.6.0, `BouncyCastle.Cryptography` 2.5.1 → 2.7.0,
+  `MinVer` 6.0.0 → 7.0.0, `Microsoft.SourceLink.GitHub` 8.0.0 → 10.0.400, and the
+  `setup-dotnet`, `codeql-action`, `publish-unit-test-result-action` and `action-gh-release`
+  pins. No library API or protocol-math change.
+- Tests now run on **Microsoft.Testing.Platform** instead of VSTest. `xunit.v3` 4.x drops the
+  VSTest bridge on the .NET 10 SDK, so `global.json` selects the MTP runner and CI uses MTP's
+  reporting flags. `coverlet.collector` is replaced by `Microsoft.Testing.Extensions.CodeCoverage`
+  and `.TrxReport`; the TRX check and Cobertura coverage report are unchanged.
+- Dependabot is now security-updates only; routine currency is handled by verified sweeps.
+
 ## [1.0.0] - 2026-07-13
 
 First stable release — the full [`Uniswap/sdks`](https://github.com/Uniswap/sdks) monorepo surface

CLAUDE.md

@@ -10,7 +10,7 @@ the V3 periphery contracts.
 
 - Target framework: **.NET 10** (`net10.0`)
 - V3 core (entities + math) is implemented and unit-tested
-- 292 xUnit v3 tests; all passing (see Outstanding work)
+- 1695 xUnit v3 tests; all passing (see Outstanding work)
 - All calldata / action-builder stubs are now implemented and test-covered (no `NotImplementedException` left)
 - Not yet packaged or published to NuGet
 
@@ -41,17 +41,30 @@ dotnet test  -c Release
 
 The projects target `net10.0` and require the .NET 10 SDK; no `DOTNET_ROLL_FORWARD` is needed.
 
+Tests run on **Microsoft.Testing.Platform (MTP)**, not VSTest — xunit.v3 4.x dropped the VSTest
+bridge on the .NET 10 SDK. `global.json` opts `dotnet test` into the MTP runner; keep it. MTP
+reporting flags go after `--` and replace the VSTest ones (`--report-trx` for `--logger trx`,
+`--coverage --coverage-output-format cobertura` for `--collect:"XPlat Code Coverage"`).
+
 CI (`.github/workflows/ci.yml`, which calls the reusable `_test.yml`) restores, builds in
 Release, and runs the tests on ubuntu/windows/macos — publishing a PR test-result check, a
 coverage comment, and a `$GITHUB_STEP_SUMMARY` table. CodeQL runs via `codeql.yml`.
 
+Dependabot is **security-updates only** (`.github/dependabot.yml` sets
+`open-pull-requests-limit: 0`). Routine currency is handled by periodic, test-verified sweeps
+rather than a stream of individual bump PRs.
+
 ## Dependencies
 
 - **Nethereum** 6.1.0 (`Nethereum.ABI`, `.Contracts`, `.Util`, `.Web3`) - ABI encoding,
   contract calls, address / keccak utilities. An explicit `Newtonsoft.Json` 13.0.4 pin overrides
   the vulnerable 11.0.2 that `Nethereum.Hex` still drags in transitively (NU1903).
 - **ExtendedNumerics.BigRational** 3000.0.2.132 - exact rational arithmetic for the fraction and price types
-- **xUnit v3** + **AwesomeAssertions** (test project only)
+- **BouncyCastle.Cryptography** 2.7.0 - Ed25519 (EdDSA) for the tamperproof-transactions port;
+  `System.Security.Cryptography` has no managed Ed25519 on `net10.0`
+- **xunit.v3** 4.0.0 + **AwesomeAssertions** 9.6.0, on Microsoft.Testing.Platform:
+  `Microsoft.Testing.Extensions.TrxReport` + `.CodeCoverage` replace the old
+  `coverlet.collector` / VSTest data collectors (test project only)
 
 ## Porting methodology
 
@@ -116,6 +129,16 @@ place. Remaining work is **Phase B** (V3 feature-parity port) and beyond.
    - **CI:** `actions/setup-dotnet` → `v5.4.0` (node24) across all workflows to clear the Node-20
      deprecation, stale `# v4`/`# v2`/`# v3` action version comments corrected, and `codeql-action/analyze`
      aligned to `init` at v4.37.0 (#26).
+
+   **Second pass (2026-09) — DONE.** The 12 Dependabot PRs that had accumulated since were landed as
+   one verified sweep behind a green 1695-test suite: `xunit.v3` `3.2.2` → `4.0.0`,
+   `xunit.runner.visualstudio` `3.1.5` → `4.0.0`, `Microsoft.NET.Test.Sdk` `18.7.0` → `18.9.0`,
+   `AwesomeAssertions` `9.4.0` → `9.6.0`, `BouncyCastle.Cryptography` `2.5.1` → `2.7.0`,
+   `MinVer` `6.0.0` → `7.0.0`, `Microsoft.SourceLink.GitHub` `8.0.0` → `10.0.400`, plus the five
+   action pins. The `xunit.v3` major forced the **VSTest → Microsoft.Testing.Platform** migration
+   (`global.json`, MTP reporting flags in `_test.yml`, `coverlet.collector` replaced by
+   `Microsoft.Testing.Extensions.CodeCoverage` + `.TrxReport`). Dependabot was switched to
+   security-updates-only at the same time.
 2. **Seven `NotImplementedException` stubs** - DONE. All ported test-first (upstream `.test.ts`
    cases, calldata matched to the digit): `PositionLibrary.SubIn256` (#32), `PriceTick` (#34),
    `Payments` (#35), `SwapQuoter` (#36), and `NonfungiblePositionManager` (create/add #39,

global.json

@@ -0,0 +1,5 @@
+{
+  "test": {
+    "runner": "Microsoft.Testing.Platform"
+  }
+}

src/UniswapSharp/UniswapSharp.csproj

@@ -40,7 +40,7 @@
     <!-- Ed25519 (EdDSA) signing/verification for the tamperproof-transactions port: .NET's
          System.Security.Cryptography has no managed Ed25519 in net10.0, so we use the pure-managed
          BouncyCastle (already present transitively via Nethereum). RSA/ECDSA stay on SSC. -->
-    <PackageReference Include="BouncyCastle.Cryptography" Version="2.5.1" />
+    <PackageReference Include="BouncyCastle.Cryptography" Version="2.7.0" />
     <PackageReference Include="ExtendedNumerics.BigRational" Version="3000.0.2.132" />
     <PackageReference Include="Nethereum.ABI" Version="6.1.0" />
     <PackageReference Include="Nethereum.Contracts" Version="6.1.0" />
@@ -49,11 +49,11 @@
     <!-- Override the vulnerable Newtonsoft.Json 11.0.2 that Nethereum.Hex still
          pins transitively (NU1903 / GHSA-5crp-9r3c-p9vr, fixed in 13.0.1+). -->
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageReference Include="MinVer" Version="6.0.0">
+    <PackageReference Include="MinVer" Version="7.0.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0">
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.400">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>

test/UniswapSharp.Testing/UniswapSharp.Testing.csproj

@@ -10,16 +10,17 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="10.0.1">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-    </PackageReference>
-    <PackageReference Include="AwesomeAssertions" Version="9.4.0" />
+    <!-- xunit.v3 4.x runs on Microsoft.Testing.Platform, so TRX and coverage come from MTP
+         extensions rather than the VSTest data collectors (coverlet.collector / "XPlat Code
+         Coverage"), which the .NET 10 SDK no longer bridges. See global.json. -->
+    <PackageReference Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.10.0" />
+    <PackageReference Include="Microsoft.Testing.Extensions.TrxReport" Version="2.3.3" />
+    <PackageReference Include="AwesomeAssertions" Version="9.6.0" />
     <!-- Ed25519 keypair generation for the tamperproof-transactions verify round-trip tests. -->
-    <PackageReference Include="BouncyCastle.Cryptography" Version="2.5.1" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
-    <PackageReference Include="xunit.v3" Version="3.2.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
+    <PackageReference Include="BouncyCastle.Cryptography" Version="2.7.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="xunit.v3" Version="4.0.0" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>